CVE-2024-43364
📋 TL;DR
This stored XSS vulnerability in Cacti allows authenticated users with external link creation privileges to inject malicious scripts via the title parameter. When other users view the affected page, the scripts execute in their browser context. All Cacti installations below version 1.2.28 are affected.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, redirect to malicious sites, or deploy malware to users' browsers.
Likely Case
Privilege escalation where lower-privileged users compromise administrator accounts, leading to full system compromise or data exfiltration.
If Mitigated
With proper input validation and output encoding, the malicious payload would be rendered harmless as plain text.
🎯 Exploit Status
Exploitation requires authenticated access with specific privileges. The vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.28
Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-fgc6-g8gc-wcg5
Restart Required: No
Instructions:
1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.28 from the official repository. 3. Replace existing files with new version. 4. Run database upgrade script if prompted. 5. Verify functionality.
🔧 Temporary Workarounds
No official workarounds
allThe vendor states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Remove 'External Link' creation privileges from all non-essential users
- Implement web application firewall rules to block XSS payloads in title parameter
🔍 How to Verify
Check if Vulnerable:
Check Cacti version via web interface or by examining the cacti.php file version headerCheck Version:
grep '\$version' /path/to/cacti/include/global.php | head -1Verify Fix Applied:
Verify version is 1.2.28 or higher and test that HTML/script input in title field is properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to links.php with script tags in parameters
- Multiple failed login attempts followed by successful login and link creation
Network Indicators:
- HTTP requests containing script tags or JavaScript in title parameter
- Outbound connections to suspicious domains after visiting Cacti pages
SIEM Query:
source="cacti_access.log" AND (uri="/links.php" AND method="POST" AND (param="title" CONTAINS "<script" OR param="title" CONTAINS "javascript:"))